a blog about technical topics I stumble upon

Menu

Tag Archives: sniffing

So, one of our domain printers was acting up and the printer department wanted me to sniff all the packets to and from the printer. So far so good, usually you could use a hub (still got one around? neither do I), or for example a switch with a monitoring or promiscuous port (not available? Welcome to the club!). Ok, now I could start arp spoofing the printer, but was too lazy to do that, besides: we have intrusion prevention up and running…

Take a good look at your machine. Is it a portable laptop like mine? Does it have any flavor of Unix or Linux on it? Well, so does mine, in this case Apple OS X (10.8.2). There’s got to be a way to bridge two ethernet interfaces, connect myself to the network and let the printer talk to the world through my laptop? You betcha!

Here’s what I did:

grab one of those USB or Thunderbolt Ethernet Adapters

ifconfig // to find out which interface is which

sudo ifconfig en3 up // bring up the USB/Thunderbolt adapter, or it won’t work!

sudo ifconfig bridge0 create

sudo ifconfig bridge0 up

sudo ifconfig bridge0 addm en0 addm en3

sudo sysctl -w net.inet.ip.forwarding=1

It works! Now we can sniff away with tcpdump or wireshark for example, and are sure that no packet is going to escape us…

And to undo what we just did:

sudo ifconfig bridge0 down

sudo ifconfig bridge0 deletem en0 deletem en3

sudo ifconfig bridge0 destroy

sudo sysctl -w net.inet.ip.forwarding=0

Many thanks to Chrissy from netnerds, who set me on the right track with her post about NAT on OS X 🙂